Swatantra-66 opened a new pull request, #21434:
URL: https://github.com/apache/nuttx/pull/21434
## Summary
Fails `sendmsg()` in `net/usrsock` with `-EINVAL` when the sum of `iov_len`
values overflows an `ssize_t` or `uint32_t`.
Previously, `usrsock_sendmsg()` accumulated `iov_len` values directly into
`req.buflen` (`uint32_t`) without overflow detection. If the sum wrapped
around, the subsequent check:
```c
if (req.buflen > UINT32_MAX)
{
req.buflen = UINT32_MAX;
}
```
was dead code because `req.buflen` is typed `uint32_t` and can never exceed
`UINT32_MAX`. This allowed silent integer truncation and protocol desync when
queuing large scatter/gather vectors.
This mirrors the POSIX IEEE Std 1003.1 compliance fix previously introduced
for `net/inet` in commit 3671f94169 (`net/inet: Fail sendmsg() when the sum of
the iov_len values overflows`).
## Impact
* **Impact on user:** POSIX IEEE Std 1003.1 compliance for `sendmsg()` over
usrsock. Prevents silent buffer length truncation when buffer length sums
exceed `ssize_t` or `UINT32_MAX`.
* **Impact on build:** None.
* **Impact on hardware:** None.
## Testing
* **CI Linters:** Verified locally against full CI checkpatch:
`./tools/checkpatch.sh -c -u -m -g upstream/master..HEAD` (exit code 0, all
checks passed including `codespell`, `cvt2utf`, commit message validator, and
`nxstyle`).
* **nxstyle:** Verified `net/usrsock/usrsock_sendmsg.c` has 0 errors and 0
warnings with `nxstyle`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
